I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly gibberish)

It resulted in a pretty big chunk of code, most of which obviously had no proper variables names attributed to it anymore; Instead, variables and functions were either named like the assembly registers they belong to, or by some hex name, or by some number/char combination that did not particularly look like hex.

However, part of the code somehow still had proper names, although they all seemed to be system functions: DrawRect, RegCreateKeyExA, DefWindowProcA, SHBrowseForFolderA, and so on - plenty of calls that seem to interact with the system.

Does that mean that the decompilation preserved Windows system calls, but not the names of functions/variables created by the developer of the file? If so, what should I do next to be able to see whether the file could have malicious intent or not?

It might also be noteworthy to say that the file I'm looking at is a Nullsoft Installer - So technically, a lot of the decompiled code is just overhead, when I actually want to look at what it installs and not the installer itself.

  • That's correct. A compiler (or better the overall toolchain, including the linker) will get rid of the "internal" names eventually. Sometimes they will be available inside debug symbols, but those hardly ever come embedded in PE files these days. – 0xC0000022L Nov 28 '20 at 21:32

In general, the compilation process removes most of the information not necessary for actual execution. This usually includes:

  • comments
  • local and global variable names
  • local (to the program) function names
  • any code deemed dead (not being executed in any situation)
  • code exhibiting undefined behavior

The names you are observing are Windows API names; because they are referred by the name, this information has to be kept for the binary to run successfully. All other names are usually removed.

Note: the API names can also be imported by a numerical ordinal in which case the name can be removed ; however this is not common on Win32 since ordinal numbers tend to change from version to version (it was common name on Win16).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.